agileflow 2.98.1 → 2.99.0

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.99.0] - 2026-02-08
+
+### Added
+- Security Hardening Phase 2 - path traversal, auth, CORS, ReDoS, rate limiting
+
 ## [2.98.1] - 2026-02-07
 
 ### Added

package/lib/api-routes.js

@@ -26,6 +26,10 @@ const {
 } = require('./paths');
 const { SessionRegistry } = require('./session-registry');
 const { getTaskRegistry } = require('../scripts/lib/task-registry');
+const { validatePath } = require('./validate-paths');
+
+// Allow-list regex for resource IDs (epics, stories, tasks, sessions)
+const SAFE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
 
 /**
  * Get API route handlers
@@ -139,6 +143,10 @@ async function getSessions(sessionRegistry, cache) {
  * GET /api/sessions/:id - Get session by ID
  */
 async function getSessionById(sessionRegistry, id, cache) {
+  if (!SAFE_ID_PATTERN.test(id)) {
+    return { error: 'Invalid session ID format' };
+  }
+
   const cacheKey = `session-${id}`;
   const cached = cache.get(cacheKey);
   if (cached) return cached;
@@ -183,7 +191,7 @@ function getStatus(rootDir, cache) {
     cache.set(cacheKey, result);
     return result;
   } catch (error) {
-    return { error: 'Failed to parse status file', message: error.message };
+    return { error: 'Failed to parse status file' };
   }
 }
 
@@ -226,7 +234,7 @@ function getTasks(rootDir, queryParams, cache) {
     cache.set(cacheKey, result);
     return result;
   } catch (error) {
-    return { error: 'Failed to load tasks', message: error.message };
+    return { error: 'Failed to load tasks' };
   }
 }
 
@@ -234,6 +242,10 @@ function getTasks(rootDir, queryParams, cache) {
  * GET /api/tasks/:id - Get task by ID
  */
 function getTaskById(rootDir, id, cache) {
+  if (!SAFE_ID_PATTERN.test(id)) {
+    return { error: 'Invalid task ID format' };
+  }
+
   const cacheKey = `task-${id}`;
   const cached = cache.get(cacheKey);
   if (cached) return cached;
@@ -249,7 +261,7 @@ function getTaskById(rootDir, id, cache) {
     cache.set(cacheKey, task);
     return task;
   } catch (error) {
-    return { error: 'Failed to load task', message: error.message };
+    return { error: 'Failed to load task' };
   }
 }
 
@@ -300,7 +312,7 @@ async function getBusMessages(rootDir, queryParams, cache) {
     cache.set(cacheKey, result);
     return result;
   } catch (error) {
-    return { error: 'Failed to read bus log', message: error.message };
+    return { error: 'Failed to read bus log' };
   }
 }
 
@@ -448,7 +460,7 @@ function getEpics(rootDir, cache) {
     cache.set(cacheKey, result);
     return result;
   } catch (error) {
-    return { error: 'Failed to list epics', message: error.message };
+    return { error: 'Failed to list epics' };
   }
 }
 
@@ -456,6 +468,10 @@ function getEpics(rootDir, cache) {
  * GET /api/epics/:id - Get epic by ID
  */
 function getEpicById(rootDir, id, cache) {
+  if (!SAFE_ID_PATTERN.test(id)) {
+    return { error: 'Invalid epic ID format' };
+  }
+
   const cacheKey = `epic-${id}`;
   const cached = cache.get(cacheKey);
   if (cached) return cached;
@@ -479,7 +495,7 @@ function getEpicById(rootDir, id, cache) {
     cache.set(cacheKey, result);
     return result;
   } catch (error) {
-    return { error: 'Failed to read epic', message: error.message };
+    return { error: 'Failed to read epic' };
   }
 }
 
@@ -533,7 +549,7 @@ function getStories(rootDir, queryParams, cache) {
 
     return { stories: [], count: 0, timestamp: new Date().toISOString() };
   } catch (error) {
-    return { error: 'Failed to list stories', message: error.message };
+    return { error: 'Failed to list stories' };
   }
 }
 
@@ -541,6 +557,10 @@ function getStories(rootDir, queryParams, cache) {
  * GET /api/stories/:id - Get story by ID
  */
 function getStoryById(rootDir, id, cache) {
+  if (!SAFE_ID_PATTERN.test(id)) {
+    return { error: 'Invalid story ID format' };
+  }
+
   const cacheKey = `story-${id}`;
   const cached = cache.get(cacheKey);
   if (cached) return cached;
@@ -569,7 +589,7 @@ function getStoryById(rootDir, id, cache) {
 
     return { error: 'Story not found', id };
   } catch (error) {
-    return { error: 'Failed to read story', message: error.message };
+    return { error: 'Failed to read story' };
   }
 }
 

package/lib/api-server.js

@@ -87,13 +87,31 @@ function createApiServer(options = {}) {
   // Get route handlers
   const routes = getApiRoutes(rootDir, cache);
 
+  // Localhost CORS allowlist
+  const ALLOWED_ORIGINS = [
+    `http://localhost:${port}`,
+    `http://127.0.0.1:${port}`,
+    'http://localhost:3000',
+    'http://127.0.0.1:3000',
+    'http://localhost:5173',
+    'http://127.0.0.1:5173',
+  ];
+
   // Create HTTP server
   const server = http.createServer(async (req, res) => {
-    // CORS headers for browser access
-    res.setHeader('Access-Control-Allow-Origin', '*');
+    // Security headers
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('X-Frame-Options', 'DENY');
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', 'application/json');
+
+    // CORS - restrict to localhost origins
+    const origin = req.headers.origin;
+    if (origin && ALLOWED_ORIGINS.some(allowed => origin === allowed)) {
+      res.setHeader('Access-Control-Allow-Origin', origin);
+    }
     res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-    res.setHeader('Content-Type', 'application/json');
 
     // Handle preflight
     if (req.method === 'OPTIONS') {
@@ -155,7 +173,6 @@ function createApiServer(options = {}) {
       res.end(
         JSON.stringify({
           error: 'Internal server error',
-          message: error.message,
         })
       );
     }

package/lib/dashboard-server.js

@@ -42,6 +42,7 @@ const {
   serializeMessage,
 } = require('./dashboard-protocol');
 const { getProjectRoot, isAgileflowProject, getAgentsDir } = require('./paths');
+const { validatePath } = require('./validate-paths');
 const { execFileSync, spawn } = require('child_process');
 const os = require('os');
 
@@ -67,7 +68,18 @@ function getAutomationRunner(rootDir) {
 
 // Default configuration
 const DEFAULT_PORT = 8765;
-const DEFAULT_HOST = '0.0.0.0'; // Allow external connections (for tunnels)
+const DEFAULT_HOST = '127.0.0.1'; // Localhost only for security
+
+// Session lifecycle
+const SESSION_TIMEOUT_MS = 4 * 60 * 60 * 1000; // 4 hours
+const SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+
+// Rate limiting (token bucket)
+const RATE_LIMIT_TOKENS = 100; // max messages per second
+const RATE_LIMIT_REFILL_MS = 1000; // refill interval
+
+// Sensitive env var patterns to strip from terminal spawn
+const SENSITIVE_ENV_PATTERNS = /SECRET|TOKEN|PASSWORD|CREDENTIAL|API_KEY|PRIVATE_KEY|AUTH/i;
 
 // WebSocket magic GUID for handshake
 const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
@@ -83,7 +95,42 @@ class DashboardSession {
     this.messages = [];
     this.state = 'connected';
     this.lastActivity = new Date();
+    this.createdAt = new Date();
     this.metadata = {};
+
+    // Token bucket rate limiter
+    this._rateTokens = RATE_LIMIT_TOKENS;
+    this._rateLastRefill = Date.now();
+  }
+
+  /**
+   * Check if session has expired
+   * @returns {boolean}
+   */
+  isExpired() {
+    return Date.now() - this.lastActivity.getTime() > SESSION_TIMEOUT_MS;
+  }
+
+  /**
+   * Rate-limit incoming messages (token bucket)
+   * @returns {boolean} true if allowed, false if rate-limited
+   */
+  checkRateLimit() {
+    const now = Date.now();
+    const elapsed = now - this._rateLastRefill;
+
+    // Refill tokens based on elapsed time
+    if (elapsed >= RATE_LIMIT_REFILL_MS) {
+      this._rateTokens = RATE_LIMIT_TOKENS;
+      this._rateLastRefill = now;
+    }
+
+    if (this._rateTokens <= 0) {
+      return false;
+    }
+
+    this._rateTokens--;
+    return true;
   }
 
   /**
@@ -167,10 +214,24 @@ class TerminalInstance {
   /**
    * Start the terminal process
    */
+  /**
+   * Get a filtered copy of environment variables with secrets removed
+   */
+  _getFilteredEnv() {
+    const filtered = {};
+    for (const [key, value] of Object.entries(process.env)) {
+      if (!SENSITIVE_ENV_PATTERNS.test(key)) {
+        filtered[key] = value;
+      }
+    }
+    return filtered;
+  }
+
   start() {
     try {
       // Try to use node-pty for proper PTY support
       const pty = require('node-pty');
+      const filteredEnv = this._getFilteredEnv();
 
       this.pty = pty.spawn(this.shell, [], {
         name: 'xterm-256color',
@@ -178,7 +239,7 @@ class TerminalInstance {
         rows: this.rows,
         cwd: this.cwd,
         env: {
-          ...process.env,
+          ...filteredEnv,
           TERM: 'xterm-256color',
           COLORTERM: 'truecolor',
         },
@@ -209,11 +270,13 @@ class TerminalInstance {
    */
   startBasicShell() {
     try {
+      const filteredEnv = this._getFilteredEnv();
+
       // Use bash with interactive flag for better compatibility
       this.pty = spawn(this.shell, ['-i'], {
         cwd: this.cwd,
         env: {
-          ...process.env,
+          ...filteredEnv,
           TERM: 'dumb',
           PS1: '\\w $ ', // Simple prompt
         },
@@ -443,8 +506,11 @@ class DashboardServer extends EventEmitter {
     this.port = options.port || DEFAULT_PORT;
     this.host = options.host || DEFAULT_HOST;
     this.projectRoot = options.projectRoot || getProjectRoot();
-    this.apiKey = options.apiKey || null;
-    this.requireAuth = options.requireAuth || false;
+
+    // Auth is on by default - auto-generate key if not provided
+    // Set requireAuth: false explicitly to disable
+    this.requireAuth = options.requireAuth !== false;
+    this.apiKey = options.apiKey || (this.requireAuth ? crypto.randomBytes(32).toString('hex') : null);
 
     // Session management
     this.sessions = new Map();
@@ -460,6 +526,9 @@ class DashboardServer extends EventEmitter {
     // Inbox management
     this._inbox = new Map(); // itemId -> InboxItem
 
+    // Session cleanup interval
+    this._cleanupInterval = null;
+
     // HTTP server for WebSocket upgrade
     this.httpServer = null;
 
@@ -544,10 +613,17 @@ class DashboardServer extends EventEmitter {
    */
   start() {
     return new Promise((resolve, reject) => {
+      const securityHeaders = {
+        'Content-Type': 'application/json',
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY',
+        'Cache-Control': 'no-store',
+      };
+
       this.httpServer = http.createServer((req, res) => {
         // Simple health check endpoint
         if (req.url === '/health') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.writeHead(200, securityHeaders);
           res.end(
             JSON.stringify({
               status: 'ok',
@@ -560,12 +636,12 @@ class DashboardServer extends EventEmitter {
 
         // Info endpoint
         if (req.url === '/') {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.writeHead(200, securityHeaders);
           res.end(
             JSON.stringify({
               name: 'AgileFlow Dashboard Server',
               version: '1.0.0',
-              ws: `ws://${this.host === '0.0.0.0' ? 'localhost' : this.host}:${this.port}`,
+              ws: `ws://${this.host === '127.0.0.1' ? 'localhost' : this.host}:${this.port}`,
               sessions: this.sessions.size,
             })
           );
@@ -597,9 +673,19 @@ class DashboardServer extends EventEmitter {
         console.log(`  WebSocket: ${wsUrl}`);
         console.log(`  Health:    ${url}/health`);
         console.log(`  Project:   ${this.projectRoot}`);
-        console.log(`  Auth:      ${this.requireAuth ? 'Required' : 'Not required'}\n`);
+        console.log(`  Auth:      ${this.requireAuth ? 'Required' : 'Not required'}`);
+        if (this.requireAuth && this.apiKey) {
+          console.log(`  API Key:   ${this.apiKey.slice(0, 8)}...`);
+        }
+        console.log('');
+
+        // Start session cleanup interval
+        this._cleanupInterval = setInterval(() => {
+          this._cleanupExpiredSessions();
+        }, SESSION_CLEANUP_INTERVAL_MS);
+        this._cleanupInterval.unref();
 
-        resolve({ url, wsUrl });
+        resolve({ url, wsUrl, apiKey: this.apiKey });
       });
     });
   }
@@ -617,15 +703,37 @@ class DashboardServer extends EventEmitter {
     // Check API key if required
     if (this.requireAuth && this.apiKey) {
       const authHeader = req.headers['x-api-key'] || req.headers.authorization;
-      const providedKey = authHeader?.replace('Bearer ', '');
+      const providedKey = authHeader?.replace('Bearer ', '') || '';
 
-      if (providedKey !== this.apiKey) {
+      // Use timing-safe comparison to prevent timing attacks
+      const keyBuffer = Buffer.from(this.apiKey, 'utf8');
+      const providedBuffer = Buffer.from(providedKey, 'utf8');
+      if (keyBuffer.length !== providedBuffer.length ||
+          !crypto.timingSafeEqual(keyBuffer, providedBuffer)) {
         socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
         socket.destroy();
         return;
       }
     }
 
+    // Check WebSocket origin against localhost allowlist
+    const origin = req.headers.origin;
+    if (origin) {
+      const LOCALHOST_ORIGINS = [
+        'http://localhost', 'https://localhost',
+        'http://127.0.0.1', 'https://127.0.0.1',
+        'http://[::1]', 'https://[::1]',
+      ];
+      const isLocalhost = LOCALHOST_ORIGINS.some(
+        allowed => origin === allowed || origin.startsWith(allowed + ':')
+      );
+      if (!isLocalhost) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+      }
+    }
+
     // Complete WebSocket handshake
     const key = req.headers['sec-websocket-key'];
     const acceptKey = crypto
@@ -750,6 +858,12 @@ class DashboardServer extends EventEmitter {
    * Handle incoming message from dashboard
    */
   handleMessage(session, data) {
+    // Rate limit incoming messages
+    if (!session.checkRateLimit()) {
+      session.send(createError('RATE_LIMITED', 'Too many messages, please slow down'));
+      return;
+    }
+
     const message = parseInboundMessage(data);
     if (!message) {
       session.send(createError('INVALID_MESSAGE', 'Failed to parse message'));
@@ -956,7 +1070,8 @@ class DashboardServer extends EventEmitter {
       this.sendGitStatus(session);
       session.send(createNotification('success', 'Git', `${type.replace('git_', '')} completed`));
     } catch (error) {
-      session.send(createError('GIT_ERROR', error.message));
+      console.error('[Git Error]', error.message);
+      session.send(createError('GIT_ERROR', 'Git operation failed'));
     }
   }
 
@@ -1062,7 +1177,8 @@ class DashboardServer extends EventEmitter {
         })
       );
     } catch (error) {
-      session.send(createError('DIFF_ERROR', error.message));
+      console.error('[Diff Error]', error.message);
+      session.send(createError('DIFF_ERROR', 'Failed to get diff'));
     }
   }
 
@@ -1073,6 +1189,12 @@ class DashboardServer extends EventEmitter {
    * @returns {string} - The diff content
    */
   getFileDiff(filePath, staged = false) {
+    // Validate filePath stays within project root
+    const pathResult = validatePath(filePath, this.projectRoot, { allowSymlinks: true });
+    if (!pathResult.ok) {
+      return '';
+    }
+
     try {
       const diffArgs = staged ? ['diff', '--cached', '--', filePath] : ['diff', '--', filePath];
 
@@ -1144,10 +1266,21 @@ class DashboardServer extends EventEmitter {
   handleTerminalSpawn(session, message) {
     const { cols, rows, cwd } = message;
 
+    // Validate cwd stays within project root
+    let safeCwd = this.projectRoot;
+    if (cwd) {
+      const cwdResult = validatePath(cwd, this.projectRoot, { allowSymlinks: true });
+      if (!cwdResult.ok) {
+        session.send(createError('TERMINAL_ERROR', 'Working directory must be within project root'));
+        return;
+      }
+      safeCwd = cwdResult.resolvedPath;
+    }
+
     const terminalId = this.terminalManager.createTerminal(session, {
       cols: cols || 80,
       rows: rows || 24,
-      cwd: cwd || this.projectRoot,
+      cwd: safeCwd,
     });
 
     if (terminalId) {
@@ -1345,8 +1478,9 @@ class DashboardServer extends EventEmitter {
       // Refresh the list
       this.sendAutomationList(session);
     } catch (error) {
-      session.send(createError('AUTOMATION_ERROR', error.message));
-      session.send(createAutomationStatus(automationId, 'error', { error: error.message }));
+      console.error('[Automation Error]', error.message);
+      session.send(createError('AUTOMATION_ERROR', 'Automation execution failed'));
+      session.send(createAutomationStatus(automationId, 'error', { error: 'Execution failed' }));
     }
   }
 
@@ -1432,6 +1566,18 @@ class DashboardServer extends EventEmitter {
     this.sendInboxList(session);
   }
 
+  /**
+   * Cleanup expired sessions
+   */
+  _cleanupExpiredSessions() {
+    for (const [sessionId, session] of this.sessions) {
+      if (session.isExpired()) {
+        console.log(`[Session ${sessionId}] Expired (idle > ${SESSION_TIMEOUT_MS / 3600000}h)`);
+        this.closeSession(sessionId);
+      }
+    }
+  }
+
   /**
    * Close a session
    */
@@ -1473,6 +1619,12 @@ class DashboardServer extends EventEmitter {
    */
   stop() {
     return new Promise(resolve => {
+      // Clear cleanup interval
+      if (this._cleanupInterval) {
+        clearInterval(this._cleanupInterval);
+        this._cleanupInterval = null;
+      }
+
       // Close all sessions
       for (const session of this.sessions.values()) {
         if (session.ws) {
@@ -1623,6 +1775,10 @@ module.exports = {
   stopDashboardServer,
   DEFAULT_PORT,
   DEFAULT_HOST,
+  SESSION_TIMEOUT_MS,
+  SESSION_CLEANUP_INTERVAL_MS,
+  RATE_LIMIT_TOKENS,
+  SENSITIVE_ENV_PATTERNS,
   encodeWebSocketFrame,
   decodeWebSocketFrame,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agileflow",
-  "version": "2.98.1",
+  "version": "2.99.0",
   "description": "AI-driven agile development system for Claude Code, Cursor, Windsurf, and more",
   "keywords": [
     "agile",

package/scripts/lib/damage-control-utils.js

@@ -450,9 +450,15 @@ function createBashHook() {
 
     /**
      * Test command against a single pattern rule
+     * Skips patterns that fail ReDoS validation
      */
     function matchesPattern(command, rule) {
       try {
+        // Validate pattern for ReDoS safety before use
+        const validation = validatePattern(rule.pattern);
+        if (!validation.safe) {
+          return false;
+        }
         const flags = rule.flags || '';
         const regex = new RegExp(rule.pattern, flags);
         return regex.test(command);
@@ -517,6 +523,37 @@ function createBashHook() {
   };
 }
 
+/**
+ * Detect ReDoS-vulnerable patterns (nested quantifiers)
+ *
+ * Checks for patterns like (a+)+ or (a*b?)* that cause
+ * catastrophic backtracking on pathological inputs.
+ *
+ * @param {string} pattern - Regex pattern string to validate
+ * @returns {{ safe: boolean, reason?: string }}
+ */
+function validatePattern(pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return { safe: false, reason: 'Empty or invalid pattern' };
+  }
+
+  // Detect nested quantifiers: a group with a quantifier containing inner quantifiers
+  // Matches patterns like (x+)*, (x+)+, (x*)+, (x+){2,}, etc.
+  const nestedQuantifierRe = /\([^)]*[+*][^)]*\)[+*{]/;
+  if (nestedQuantifierRe.test(pattern)) {
+    return { safe: false, reason: `Nested quantifier detected in: ${pattern}` };
+  }
+
+  // Try to compile the regex to catch syntax errors
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return { safe: false, reason: `Invalid regex: ${e.message}` };
+  }
+
+  return { safe: true };
+}
+
 module.exports = {
   c,
   findProjectRoot,
@@ -529,6 +566,7 @@ module.exports = {
   parseBashPatterns,
   parsePathPatterns,
   validatePathAgainstPatterns,
+  validatePattern,
   createPathHook,
   createBashHook,
   CONFIG_PATHS,

package/src/core/templates/damage-control-patterns.yaml

@@ -16,7 +16,7 @@ version: "1.0.0"
 
 bashToolPatterns:
   # ─── File System Destruction ───
-  - pattern: '\brm\s+(-[rRf]+\s+)*/'
+  - pattern: '\brm\s+(-[rRf]+\s+)?/'
     reason: "rm with absolute path - could delete system files"
 
   - pattern: '\brm\s+-[rRf]*\s+\.\.'
@@ -25,7 +25,7 @@ bashToolPatterns:
   - pattern: '\brm\s+-rf\s+'
     reason: "Recursive force delete - extremely dangerous"
 
-  - pattern: '\brmdir\s+(-p\s+)*/'
+  - pattern: '\brmdir\s+(-p\s+)?/'
     reason: "rmdir with absolute path"
 
   # ─── Git Destructive Operations ───